CVE Intelligence
Analysis AI-assisted

CVE-2026-39999: Apache APISIX Authentication Bypass by Spoofing via jwt-auth Plugin

CVE-2026-39999 is an authentication bypass by spoofing (CWE-290) in Apache APISIX, linked to certain configurations of the jwt-auth plugin. The record states that the issue affects versions from 2.2 through 3.16.0 and is fixed in 3.17.0. NVD rates it 9.1 under CVSS 3.1, and the record shows no CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-39999 is an authentication bypass by spoofing (CWE-290) in Apache APISIX. According to the CVE record, certain configurations of the jwt-auth plugin allow an attacker to bypass authentication completely.

Impact

The record describes a complete authentication bypass. NVD scores it 9.1 under CVSS 3.1 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and the Apache CNA scores it 7 under CVSS 4.0. Because the plugin is used to validate JWTs on protected routes, a successful bypass would likely expose functionality behind that validation. This last point is an inference, not a stated consequence.

Affected products and versions

  • Apache APISIX from 2.2 through 3.16.0. The structured affected range reads 2.2 or later and before 3.17.0.
  • Only deployments using the affected jwt-auth configurations are described as vulnerable. The record does not list those configurations.

Exploitation status

The record does not list this CVE in CISA KEV. No confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade Apache APISIX to version 3.17.0, which the CNA description states fixes the issue.
  • Identify which routes use the jwt-auth plugin and review how it is configured on routes that protect sensitive services.
  • Until upgrading is complete, consider restricting access to sensitive routes through network controls. This is a general defensive measure; the sources do not evaluate its effectiveness for this issue.

Detection guidance

  • Review gateway logs for requests reaching protected routes that lack expected authentication outcomes, and for unusual patterns of successful authentication.
  • Inventory APISIX instances and confirm which fall within the affected range.

Limitations of the available information

The record does not specify the affected jwt-auth configurations, the root cause, or any entries in the fixes field. It also does not provide EPSS data. Sources consulted: NVD, CVE Record, Apache mailing list, oss-security.

Frequently asked questions

Is CVE-2026-39999 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which version fixes this issue?

The CNA description states that upgrading to 3.17.0 fixes the issue. The record's fixes field is empty, so the vendor's own fix listing should be checked.

Are all Apache APISIX deployments affected?

The record links the issue to certain jwt-auth configurations within the affected range. The exact configurations are not listed, so administrators should review their own setups.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.